WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
Digital Climate Strike WP <= 1.0.0 - Malicious Redirect
7.1
CVE ID Unknown
Jan 21, 2021
Researcher: Steve Perry
Thumbnail carousel slider < 1.0.1 - Stored Cross-Site Scripting and Cross-Site Request Forgery
7.1
CVE ID Unknown
Dec 28, 2020
Researcher: Arash Khazaei
Brizy Page Builder <= 2.3.11 - Incorrect Authorization Checks Allowing Post Modification
7.1
CVE-2021-38345
Oct 13, 2020
Researcher: Ram
Kali Forms <= 2.1.1 - Missing Authorization to Settings Update
7.1
CVE-2020-36720
Aug 21, 2020
Researcher: Jerome Bruandet
WP Elegant Testimonial <= 1.1.6 - Cross-Site Scripting
7.1
CVE ID Unknown
Aug 15, 2020
Researcher: Melbin K Mathew
Gallery PhotoBlocks <= 1.1.5 - Cross-Site Scripting
7.1
CVE ID Unknown
Jul 29, 2020
Researcher: Vishnupriya Ilango
Careerfy <= 4.3.0 - Reflected Cross-Site Scripting
7.1
CVE ID Unknown
Jul 22, 2020
Researcher: RE-ALTER
Golo - City Travel Guide WordPress Theme < 1.3.3 - Reflected Cross-Site Scripting
7.1
CVE ID Unknown
Jul 11, 2020
Researcher: RE-ALTER
CareerUp < 2.3.1 - Reflected Cross-Site Scripting
7.1
CVE-2022-1167
Jul 3, 2020
Researcher: RE-ALTER
Findgo <= 1.3.31 - Cross-Site Scripting
7.1
CVE ID Unknown
Jun 17, 2020
Researcher: RE-ALTER
WP JobSearch < 1.5.1 - Reflected Cross-Site Scripting
7.1
CVE-2022-1168
Jun 3, 2020
Researcher: Daniel Ruf
LearnPress <= 3.2.6.8 - Authenticated Page Creation and Status Modification
7.1
CVE-2020-11510
Apr 19, 2020
Researcher: Ram
LearnPress <= 3.2.6.6 - Privilege Escalation
7.1
CVE-2020-7916
Mar 16, 2020
Researchers:
Fruitful < 3.8.1 - Reflected Cross-Site Scripting
7.1
CVE ID Unknown
Feb 17, 2020
Researcher: Ultra Security Team
Events Manager < 5.9.7.2 & Events Manager Pro < 2.6.7.2 - Unauthenticated CSV Injection
7.1
CVE ID Unknown
Feb 6, 2020
Researcher: Vishnupriya Ilango
WP DS FAQ Plus < 1.4.2 - Cross-Site Scripting
7.1
CVE ID Unknown
Jan 24, 2020
Researcher: Wilco de Jongh
Videos on Admin Dashboard < 1.1.4 - Cross-Site Scripting
7.1
CVE ID Unknown
Jan 12, 2020
Researcher: Jeroen Mulder
Minimal Coming Soon & Maintenance Mode <= 2.10 - Missing Authorization
7.1
CVE-2020-6168
Dec 18, 2019
Researcher: Chloe Chamberland
Bridge Theme <= 18.2, Qode Instagram Widget <=2.0.1, Qode Twitter Feed <= 2.0.0 - Open Redirect
7.1
CVE ID Unknown
Oct 21, 2019
Researcher: Mikey Veenstra
Human Presence – Stop Form Spam Without ReCaptcha < 2.0.9 - Reflected Cross-Site Scripting
7.1
CVE ID Unknown
Sep 11, 2019
Researcher: Ricardo Sanchez
Title CVE ID CVSS Researchers Date
Digital Climate Strike WP <= 1.0.0 - Malicious Redirect 7.1 Steve Perry January 21, 2021
Thumbnail carousel slider < 1.0.1 - Stored Cross-Site Scripting and Cross-Site Request Forgery 7.1 Arash Khazaei December 28, 2020
Brizy Page Builder <= 2.3.11 - Incorrect Authorization Checks Allowing Post Modification CVE-2021-38345 7.1 Ram October 13, 2020
Kali Forms <= 2.1.1 - Missing Authorization to Settings Update CVE-2020-36720 7.1 Jerome Bruandet August 21, 2020
WP Elegant Testimonial <= 1.1.6 - Cross-Site Scripting 7.1 Melbin K Mathew August 15, 2020
Gallery PhotoBlocks <= 1.1.5 - Cross-Site Scripting 7.1 Vishnupriya Ilango July 29, 2020
Careerfy <= 4.3.0 - Reflected Cross-Site Scripting 7.1 RE-ALTER July 22, 2020
Golo - City Travel Guide WordPress Theme < 1.3.3 - Reflected Cross-Site Scripting 7.1 RE-ALTER July 11, 2020
CareerUp < 2.3.1 - Reflected Cross-Site Scripting CVE-2022-1167 7.1 RE-ALTER July 3, 2020
Findgo <= 1.3.31 - Cross-Site Scripting 7.1 RE-ALTER June 17, 2020
WP JobSearch < 1.5.1 - Reflected Cross-Site Scripting CVE-2022-1168 7.1 Daniel Ruf June 3, 2020
LearnPress <= 3.2.6.8 - Authenticated Page Creation and Status Modification CVE-2020-11510 7.1 Ram April 19, 2020
LearnPress <= 3.2.6.6 - Privilege Escalation CVE-2020-7916 7.1 March 16, 2020
Fruitful < 3.8.1 - Reflected Cross-Site Scripting 7.1 Ultra Security Team February 17, 2020
Events Manager < 5.9.7.2 & Events Manager Pro < 2.6.7.2 - Unauthenticated CSV Injection 7.1 Vishnupriya Ilango February 6, 2020
WP DS FAQ Plus < 1.4.2 - Cross-Site Scripting 7.1 Wilco de Jongh January 24, 2020
Videos on Admin Dashboard < 1.1.4 - Cross-Site Scripting 7.1 Jeroen Mulder January 12, 2020
Minimal Coming Soon & Maintenance Mode <= 2.10 - Missing Authorization CVE-2020-6168 7.1 Chloe Chamberland December 18, 2019
Bridge Theme <= 18.2, Qode Instagram Widget <=2.0.1, Qode Twitter Feed <= 2.0.0 - Open Redirect 7.1 Mikey Veenstra October 21, 2019
Human Presence – Stop Form Spam Without ReCaptcha < 2.0.9 - Reflected Cross-Site Scripting 7.1 Ricardo Sanchez September 11, 2019
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Aug 31, 2024
Vulns
1 Francesco Carlucci 30
2 vgo0 27
3 wesley (wcraft) 21
4 Lucio Sá 13
5 Krzysztof Zając 10
6 stealthcopter 10
7 Peter Thaleikis 7
8 Marco Wotschka 7
9 Webbernaut 6
10 TANG Cheuk Hei (siunam) 5
11 Daniel Ruf 5
12 zer0gh0st 4
13 LVT-tholv2k 3
14 Robert DeVore 3
15 Le Ngoc Anh 3
16 rezaduty 3
17 Rafie Muhammad 2
18 Tonn 2
19 Jorge Diaz (ddiax) 2
20 Michelle Porter 2

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation